Re: [MLS] multiple devices per user?

Hey all,

Sorry, I was in meetings over the weekend and missed the fun :)  Let me try
to sum up.

tl;dr:  It's an application decision. The protocol should be oriented
around per-device keys, but we should also document the privacy concerns
and some approaches to mitigating them.

I agree with DKG that we should not hard-code a one-key-per-device
assumption into the protocol.  But at the same time, I don't want this
group to have to assume the complexity of a protocol to sync keys across
devices in addition to what it's already got.  And has been pointed out,
there are some valid reason to want individual device keys to be exposed in
the protocol, e.g., key comparison and device revocation.

Fortunately, we don't have to make a choice here.  Because the protocol
doesn't know whether a leaf key is an actual leaf or the root of a subtree,
there's a clean interface point where applications can make a decision.
You could even imagine different clients in one group making different
decisions.

So I would suggest we do the following:
- No change to the protocol document
- In the architecture document:
  - Lay out the privacy risk that can arise from using per-device keys
  - Present the two approaches discussed in this thread for how to do key
sync (explicit sync and sub-trees)

That way, the WG's document set will provide guidance to implementors about
the risks and how to mitigate, without diving into the complexity of a full
protocol.

--Richard

On Mon, Mar 26, 2018 at 10:16 AM, Rich Persaud <persaur@gmail.com> wrote:

> On Mar 24, 2018, at 18:42, Eric Rescorla <ekr@rtfm.com> wrote:
>
> On Sat, Mar 24, 2018 at 10:32 PM, Daniel Kahn Gillmor <
> dkg@fifthhorseman.net> wrote:
>
>>
>> Furthermore, it's not clear what a group conversation participant can
>> *do*, security-wise, in the event of recieving such a message from
>> another participant -- is this actually a new phone, or is it a wiretap
>> injection?  should i ask the user about it?  should i take action?  what
>> ction?
>>
>
> In Wire, if Alice has marked each of Bob's device fingerprints as
> "verified", then the addition of a new device by Bob results in an
> immediate message to Alice.  The recommended action is to verify the new
> fingerprint out of band, then Alice can mark Bob's new device as
> "verified".
>
>
> Generally, I wouldn't expect them to take any action at all. It's a user's
> responsibility to ensure that the right number of devices are registered
> to their account, just as its common for the number of Web browsers
> one has attached to ones Gmail account.
>
>
> Here is a scenario on iOS:
>
> (1) User is logged into Facebook via Chrome.  User is not logged into
> Facebook in Safari, to avoid Facebook tracking on non-Facebook websites
> visited in Safari.
>
> (2) User receives FB email notification in Apple email.  If user clicks on
> a link in the email, it opens in Safari and Facebook *automatically logs
> the user in without a password*.
>
> (3) User then receives FB email notification that they have added a new
> device.
>
> (4) User must now manually log out of Facebook, then click on a tiny close
> button on account icon to delete the cookie associated with that user, to
> avoid Facebook tracking on non-Facebook websites.  That removes (?) the
> browser as a known device.
>
> Each of the individual UX decisions above could make sense in some
> contexts, but when combined on iOS where the user cannot choose the browser
> in which email links are opened, it leads to an undesirable UX where the
> user must invest repeated effort to ensure that the right number of devices
> are registered to their account.
>
> Rich
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls
>
>